They called themselves Scattered Spider, and for 16 hours they broadcast their rampage live: two teenage hackers who burrowed into the heart of Transport for London’s IT systems and held what prosecutors called “the keys to the kingdom”.
On Thursday, Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, were each sentenced to five years and six months in prison for the cyber-attack that crippled TfL in 2024. Flowers also received the same term for hacking two US healthcare providers.
“Teen hackers who crippled TfL and stole millions of customer details sentenced to 5.5 years.”
The pair pleaded guilty in June to carrying out the hack, which began at 5pm on 31 August and stretched over four days. Using a simple trick – they convinced a TfL phone help desk worker to reset an employee’s password – they gained access to the authority’s systems and created a “domain admin” account, effectively giving them the highest possible privileges.
Once inside, the duo searched TfL’s customer database for London celebrities and attempted to access banking details. Telegram messages showed them boasting about the breach. “Scattered Spider is creating webs on the London Underground,” Flowers later joked.
The attack disrupted TfL’s online services for months, stole the personal data of millions of customers – as many as 10 million, according to the BBC – and forced all 27,000 TfL employees to reset their passwords in person. TfL was unable to process payments on Oyster and contactless apps, and the dial-a-ride service for disabled Londoners was knocked out for a period, unable to process bookings.
TfL’s head, Andy Lord, a veteran of British Airways, described it as the worst incident he had faced in his career. The transport authority said the hack could have caused “catastrophic damage” and led to “significant and extended transport service degradation”. In the end, TfL was forced to “pull the plug” – disconnecting its systems from the internet altogether. In total, 148 technology systems became inoperable.
The financial toll: £29m in direct costs plus an estimated £10m in lost income, according to TfL.
Sentencing the pair at Woolwich Crown Court, Mr Justice Turner said the attack was “primarily motivated by selfish bravado, heedless of the severe consequences to others”. He described them as loners who had few offline friends.
Jubair lived with his parents in a council flat in Bow, east London; Flowers with his grandmother and uncle in a three-bedroom home in Walsall. The National Crime Agency (NCA) has warned that the rise of young hackers like these poses one of the biggest threats to the nation’s cyber security. Scattered Spider, the loosely coordinated group they belonged to, has been linked to dozens of other attacks including on retailers Marks and Spencer and the Co-op.
But for London, the damage is already done: the stolen database – containing the details of up to 10 million customers – is still being shared in criminal groups, the BBC has revealed.